CVE-2021-27585: 
SAP 3D Visual Enterprise Viewer vulnerability analysis and mitigation

CVE-2021-27585 is a vulnerability affecting SAP 3D Visual Enterprise Viewer version 9, specifically related to the parsing of Computer Graphics Metafile (.CGM) files. The vulnerability was discovered in November 2020 and publicly disclosed on March 15, 2021. When exploited, this vulnerability allows remote attackers to execute arbitrary code on affected installations of the software (ZDI Advisory, CVE Details).

The vulnerability has a CVSS score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The specific flaw exists within the parsing of CGM files and manifests in two ways: a stack-based buffer overflow due to improper validation of user-supplied data length, and a memory corruption condition resulting from inadequate validation of user-supplied data. Both variations of the vulnerability can lead to code execution in the context of the current process (ZDI Advisory, ZDI Advisory).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code on affected installations of SAP 3D Visual Enterprise Viewer. When a user opens manipulated CGM format files from untrusted sources, the application crashes and becomes temporarily unavailable until restart (CVE Details).

The vulnerability requires user interaction to exploit, specifically the target must visit a malicious page or open a malicious file. The attack vector is local with low attack complexity, requiring no privileges but user interaction (ZDI Advisory).

The vulnerability has been fixed in SAP 3D Visual Enterprise Viewer 9.0 FP10 MP2. Users are advised to update to this version or later to mitigate the vulnerability (ZDI Advisory).